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We present a general technique for hiding a classical bit in multi-partite quantum states. The 
hidden bit, encoded in the choice of one of two possible density operators, cannot be recovered 
by local operations and classical communication without quantum communication. The scheme 
remains secure if quantum communication is allowed between certain partners, and can be designed 
for any choice of quantum communication patterns to be secure, but to allow near perfect recovery 
for all other patterns. The maximal probability of unwanted recovery of the hidden bit, as well 
as the maximal error for allowed recovery operations can be chosen to be arbitrarily small, given 
sufficiently high dimensional systems at each site. No entanglement is needed since the hiding states 
can be chosen to be separable. A single ebit of prior entanglement is not sufficient to break the 
scheme. 
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INTRODUCTION 

Many secrets in the world are locked away with keys 
distributed among many parties. A well-known classical 
scheme for this is Shamir's secret sharing jjj, in which a 
pre-assigned fraction of the key-possessing parties needs 
to contribute their parts of the key to unlock the secrets. 
There are two directions in which this can be generalized 
to hiding information in multi-partite quantum states. In 
the first version called "quantum secret sharing" , the bit 
is hidden in a way that some parties can recover the bit 
via local operations and classical communication ^ [|. 
Typically the information is then hidden in pure states 
and the theory is closely related to the theory of error 
correcting codes, the errors corresponding to the parties 
whose part of the key is not available. In the second 
version, which has been called "quantum data hiding" 
H, ffl, and which we follow in this paper, one still hides 
a classical bit, but the quantum structure is used to in- 
crease the demands on the communication needed for the 
recovery. Arbitrary classical communication between N 
parties (along with arbitrary local quantum operations) 
is allowed, but only with a pre-assigned amount of quan- 
tum information exchange the hidden information can be 
retrieved. 

In {§ | only the case N = 2 was considered. Since 
the hiding states have very high symmetry in that case 
(they are special "Werner states" |6|) DiVincenzo et al. 
suggest that multi-partite (i.e., N > 2) data hiding sce- 
narios might be based on highly symmetric multi-partite 
entangled states such as the ones studied in our paper 
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Building on this idea we will generalize data hiding to 
an extremely versatile scheme: For AT-partite systems one 
can freely choose for which patterns of quantum commu- 
nication the hidden bit can be retrieved, and for which 
patterns it remains hidden. The level of security can 
be chosen arbitrarily high: the maximal probability of 



unwanted recoveries and probability for erroneous iden- 
tification using an allowed pattern of quantum commu- 
nication go to zero like the inverse of the dimension of 
the Hilbert spaces at each site. Expressed in terms of the 
number of hiding qubits this is exponentially good. 

Surprisingly, no entanglement is needed for this 
scheme: the hiding states can be chosen to be separable 
(this was strongly suggested, but not proved in j|, In 
keeping with this, the scheme cannot be broken with a fi- 
nite amount of prior entanglement. For an entanglement 
based scheme one would expect that hiding a single bit 
between two parties becomes insecure if one ebit of prior 
entanglement is available to them. However, we will show 
that the amount of entanglement needed to break secu- 
rity is instead of the order needed to establish quantum 
communication by teleportation. 

In this letter we will focus on the main points of the 
construction and the main ideas of the proof. For brevity, 
we will give details only for the case of AT = 4 equivalent 
parties. Full proofs of the case of general A~ and parties 
possibly playing different roles, will appear elsewhere [g]. 



MAIN RESULT 

Throughout we will assume that one classical bit has 
been encoded in the preparation of a multi-partite quan- 
tum system, by preparing either a density operator po 
or pi on the Hilbert space Hi ® • • • ® Wjv- We imagine 
the N subsystems to be distributed to widely separated 
laboratories. The aim of the parties is to find out the 
value of the hidden bit. For this they are allowed ar- 
bitrary classical communication and can perform local 
quantum operations. In addition they may have estab- 
lished quantum communication lines between some of the 
labs, and their success will depend crucially on which 
quantum lines are available. Since we do not distinguish 
between good and bad quantum lines, this pattern of al- 
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lowed quantum communication is encoded in a partition 
V of the N sites into disjoint subsets: inside each of the 
subsets arbitrary quantum communication is allowed, so 
these sites act like one party, but no quantum commu- 
nication is possible between sites in different subsets of 
V . For example, the partition V = ({1, 2}, {3, 4}) means 
that sites 1 and 2 can exchange quantum information 
freely, just like 3 and 4, but between these groups only 
classical communication is allowed. 



Whatever procedure the N parties apply will amount 
to measuring some "analyzing operator" A, < A < 1 
such that the probability for guessing the value "1" of 
the hidden bit on an initial preparation p is tr [pA] . The 
locality conditions imply that only certain operators A 
are admissible for V . Of course, the parties will try to 
make tr [pi A] w 1 and tr [poA] w 0. We say that for a 
particular pair of hiding states p\ , po a partition V is 
hiding with quality e±, if | tr [(pi — po)A] | < ej for all 
admissible analyzing operators A. On the other hand, 
we say that V is revealing with quality £2, if for some 
admissible A we have | tr [(pi — po)A] | > 1 — £2- 



Whoever is hiding the information does not know in 
advance what communication pattern will be established. 
But, as our construction will show, the states pi,po can 
be designed such that, for any choice of £1,62 > 0, ev- 
ery partition is either hiding or revealing with quality £1 
or £2 respectively. The set of hiding partitions can be 
chosen arbitrarily subject only to the trivial constraint 
that for every partition which is finer than a hiding one, 
i.e., which corresponds to a pattern allowing less quan- 
tum communication, must itself be hiding. We remark 
that the Hilbert space dimensions need to become large 
if the Ei are small. In fact, in our construction the £j 
typically behave like l/d, if d is the dimension of the 
one-site Hilbert spaces. The construction naturally also 
yields separable states p±, po satisfying the conditions, al- 
though for these still higher dimensions d are required to 
achieve the same errors. 



In this letter we will explicitly construct hiding states 
pi,po for all choices of hiding partitions of 4 parties, 
which are democratic in the sense that each site plays the 
same role. It is remarkable that two such choices are not 
comparable in the sense that neither allows more commu- 
nication than the other: we will give states for which any 
2:2 partition ({1, 2}, {3, 4}) is hiding and any 3:1 parti- 
tion ({1, 2, 3}, {4}) is revealing, but also states for which 
the opposite is true. Hence "hiding strength" of pairs 
of states cannot be parametrized by a one-dimensional 
scale. 



CONSTRUCTION 
Symmetric states 

We begin by restricting ourselves to a class of highly 
symmetric states known as multipartite Werner states 
. Their main virtue is that they can be described by a 
fixed set of parameters while the local Hilbert space di- 
mensions go to infinity. By definition, 4-partite Werner 
states live on (C d )® 4 ), and commute with all unitary op- 
erators of the form C/® 4 with U a unitary operator on the 
rf-dimensional Hilbert space C d . This is equivalent to the 
possibility of writing the state as linear combinations of 
permutation operators (see Q). For any permutation w 
of the four sites we will denote the corresponding permu- 
tation operator by V n := Ylt j k 1=1 \^{ijkl)){ijkl\. 

Since the communication patterns we consider are 
invariant under permutations we can even choose the 
states to be permutation symmetric. We denote by 
(«i, 12, ■ ■ ■ , i r ) the cyclic permutation ij n i 2 ^ • ■ ■ h 
i r h- > i\. Then we must have, e.g., tr f/>iV(i2)] = 
tr [pjV(23)l , since these permutations differ only by a rela- 
belling of the sites. This leaves just 4 expectations char- 
acterizing the state, namely 

r% = tr [piV(i2)] r 22 = tr [pjV(i 2 )(34)] 

r 3 = tr [piF(i23)] r 4 = tr [/9jF(i 2 34)] ■ (1) 

We will fix this vector p — (r 2 , r 22 , ^3, ^4) of expecta- 
tions independently of the dimension d. Thus we auto- 
matically get hiding schemes, which work for all dimen- 
sions, though achieving e\ — > only in the limit d — > 00. 
Whether or not a particular vector of expectations cor- 
responds to a family of density operators can be decided 
independently of the dimension by group theoretical cri- 
teria, the extremal possibilities being given by irreducible 
representations of the permutation group. For details we 
refer to g. 

Analyzing operators for fixed V 

Without loss of discriminating power we can then sup- 
pose that the analyzing operators A also have the £/® 4 
symmetry: The 4 parties only have to perform the same 
random unitary rotation at every site ( "twirling" ) before 
realizing their procedure. The resulting A will commute 
with £/® 4 but will have exactly the same discriminat- 
ing power for states insensitive to such unitary rotations. 
Hence we can write 

A = a*Vi< (2) 

7T 

with suitable coefficients a n . Note that this averaging 
operation does not work for the permutation symmetry, 
because the permutations are non-local operations, which 
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would clearly require the exchange of quantum informa- 
tion. 

It turns out that in the sum @ we must distinguish 
two types of terms depending on how the permutation tt 
relates to the partition V . We say that tt is adapted to 
V, if tt maps each of the sets in the partition into itself. 
Clearly, if only the coefficients a* for tt adapted to V 
are non-zero, A is a local operator in this communication 
situation, hence admissible. Only such local operators 
will be needed to show that certain patterns are revealing 
in our theory. 

The key problem (settled in the following subsection) 
is the converse, namely to show that every operator A 
which is admissible for the partition V is at least approx- 
imately of this sort. Fortunately, we can use here the 
same simple criterion already employed in (J, which 
is based on partial transposition. The partial transpose 
operation 6s associated with a subset S C {1, 2, 3, 4} of 
the sites takes a tensor product operator A\ ® • • • ® A± to 
a similar product, in which all Ai with i G S are replaced 
by their matrix transpose in a fixed basis. For example, 
©{2,3} transposes only the second and the third tensor 
factor of the input. The arguments in j|, |j| then tell us 
that, for any operator A, which is admissible for V, we 
must have that 



< & S (A) < 1 



(3) 



for all subsets S compatible with V, i.e., for all S which 
can be written as unions of the disjoint subsets forming 
the partition V . Since positivity is preserved under global 
transposition, it suffices to verify this for either S or its 
complement. For example, for V = ({1}{2, 3}{4}), we 
must require (||) for the four subsets S = (empty set), 
{!}, {2,3}, and {4}. 



Coefficients of admissible operators 



cients in the sum (0) from 

a n = d- 4 tr[V;A} + 0(l/d) 



(4) 



A crucial step in our estimate is to get the trace norm 
) of partially transposed permuta- 



XU = tr 



tion operators. We claim that 

\\Qs(V„)\\i =d 4 - 1 ^ 



(5) 



where Is (ft) denotes the number of points in S, which 
are mapped outside S. Rather than proving this in gen- 
eral, consider as an example the case S = {1,2} and 
tt = (2,3). Since '1' is fixed and '2' is mapped to '3' 
outside S, we have ls(ft) — 1. We can write Os(K-) = 
s(E 4jnm \ijnm){injm\) = Y, ljnm \innm){ijjm\. This 
can be written as d 1 (8 P^ 23 ) <g> 1, where p( 23 ) denotes 
the one dimensional projection onto the maximally en- 
tangled vector on sites 2 and 3. Thus Sg(V^) has only 
the non-zero eigenvalue d with multiplicity d 2 . This gives 
||©s(^7r)||i = d 3 as claimed. More generally, ls(ft) ap- 
pears in this computation as the number of repeated in- 
dices in either ket or bra in the analogous representation 

ofe s (v„). 

We now apply the standard estimate tr [XY] < \\X\\ \ ■ 
\\Y\\, and use that taking a partial transpose of both X 
and Y does not change the trace. Hence, if | |©s(A)| | < 1, 

d- 4 |tr[AK]| = d- 4 |tr[e s (A)e s (K)]| 

< d- 4 \\Q s (V a )\\ 1 \\e s (A)\\ < d- ls ^(6) 

Coming back to the statement of the Lemma: let tt 
not be adapted to V . Then there is some set S of the 
partition, which is not mapped into itself by tt. For this 
set Is (ft) > 1. On the other hand, since A is admissi- 
ble for V the inequality (|J) must hold for this S, hence 
1 1 ©S (A) 1 1 < 1. Hence by combining (Q) with (§) we get 
la* | = d- 4 |trL4K]| +0(l/d) < d- ls ^ +0(l/d) = 
0(l/d). 



In this subsection we sketch the proof of the following 
Lemma: 

Suppose that A is an analyzing operator, which is ad- 
missible for the partition V . Then in the sum jljj all 
coefficients a* with tt not adapted to V are bounded by 
c/d, where c is a constant depending only on N. 

We will abbreviate by 0(1/ d) any terms bounded by 
a constant times 1/d, and leave the estimate of the con- 
stants to ||]. Consider the matrix M given by M n<a — 
d" 4 tr \V*V a ] ■ Then since tr [K] = d c 7 where c is the 
number of cycles in tt (including those of length 1), we 
find M^.cr = (5^,(7 + 0(1/ d). Thus to leading order in 
d, the permutation operators are an orthonormal system 
with respect to the normalized trace. Then by standard 
perturbation theory the matrix M _1 is also close to the 
identity, and we can approximately determine the coeffi- 



Tailoring the states 

The idea of the construction is to choose p\ and po so 
that tr[piVjr] = tr [poK-] , for all permutations tt which 
are adapted to any of the targeted hiding partitions V . 
Thus when we insert (^) into tr[(px — Po)^] f° r any A 
admissible for V the only contributing coefficient are 
(!„ = 0(l/d). Hence the whole expectation goes to zero. 

On the other hand, we will make sure that 
tr [(pi — po)Kr] 7^ 0, for at least one permutation adapted 
to each of the targeted revealing partitions. From this we 
get an admissible analyzing operator with analyzing qual- 
ity £2^0, and independent of d. Analysis may not be 
with probability one, but imperfect analysis can always 
be upgraded to certainty as described in the following 
section. 
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Verifying the examples 

In the following examples the hiding states are given 
in terms of the vector of expectations in ([!]). The hiding 
partitions in each example are the given partition, to- 
gether with all its permutations and all its refinements. 
Weakest hiding. The only permutation adapted to the 
finest partition V = ({1}, {2}, {3}, {4}) is the identity. 
Hence any way of fixing the expectations of permutation 
operators gives a hiding pair of states. For example, we 
can take po (resp. pi) as the normalized projection to 
the Bose (=symmetric) subspace (resp. the Fermi ^an- 
tisymmetric) subspace) of (C d ) m . Thus p" = (1, 1, 1, 1) 
and pi — (—1, 1, 1, —1)- Obviously, if just two partners, 
e.g., 1 and 2, can exchange quantum information they can 
find out which alternative 0/1 was chosen by just looking 
at the restriction of the state to their pair of subsystems, 
and measuring "symmetry" A = (1 + V\2)/2. 
Hiding against single pairs. For all pair partitions 

V = ({1,2}, {3}, {4}) the states p Q = |(— 1,-1,0, 1) and 
pi = |(— 1, 3, 0, —1) are hiding. Analysis for 'single pairs' 
and 'triplets' (see below) is imperfect. 

Hiding against two pairs. For all partitions like 

V = ({1,2}, {3, 4}), the states p" = (0,1,1,0) and 
pi = (0,1,-^,0) are hiding. However, a partition 
({1,2, 3}, {4}) can use A = |(1 + U (123) + U (321) ), to 
distinguish these with certainty. 

Hiding against triplets. Conversely, the states po = 
|(3,1,0,3) and pi = |(1,— 1,0, — 1) are hiding for any 
partition like V — ({1, 2, 3}, {4}), but can be analyzed 
(imperfectly) by two pairs. 

Strongest hiding Finally, the states po = j(0, 0,1,2) 
and pi = 4(0,0,1,-2) are hiding unless quantum com- 
munication between all parties is established, in which 
case they can be distinguished perfectly. 



MULTIPLE COPIES ENHANCE RECOVERY 



Thus they can even be chosen to be close to the max- 
imally mixed state and, in particular, separable. Since 
this was conjectured in j|, |j| we include an explicit ex- 
ample, namely the bipartite (N = 2) case of our con- 
struction. At the same time this illustrates nicely the 
interplay between the parameters d and K . 

We use a simplified (but slightly weaker) bound to 
establish hiding: Since all admissible analyzing opera- 
tors satisfy < 0{ 2 }(^4) < 1, we get | tr [(pi — po)A] \ = 

|tr[e {2} (p 1 -p )e {2} (A)] | < ||e {2} o>i-fl))||i. 

Our single copy scheme is based on bipartite Werner 
states. With P± the anti/symmetric projectors on C d <B> 
C d and p± = P±J tr [P±] our hiding states are: 



Po 



P- 



K 



(7) 



which are clearly separable ||. From this one can read- 
ily compute the partial transposes ®{2}(Pi)® K and their 
trace norm difference, as well as the expectations of the 



analyzing operator A = Pf , to get: 



£i 



l-(l-l/d) K , and e 2 = 2 



-K 



(8) 



Thus we can first choose K large to make £2 small, and 
subsequently d large, to get E\ = K/d+ 0(d~ 2 ) small. 

This separable scheme is remarkably robust even if 
the analyzing partners share some entanglement: If they 
share a maximally entangled pair of a .D-dimensional sys- 
tem with fixed D, we get the same asymptotic behaviour 
in the limit d — > 00, just with worse constants. Only if 
we choose D to grow on the same scale as d, i.e., on the 
same scale which would make teleportation possible, we 
find that hiding becomes impossible. 
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As these examples show, our construction so far does 
not guarantee perfect distinction (e 2 = 0) for the par- 
titions meant to be revealing. However, there is a sin- 
gle device to boost the detection quality, namely to dis- 
tribute several, say K copies of the iV-particle system, 
all prepared in the same state. Then for the hiding par- 
titions wc still get E\ = 0(l/d). On the other hand, for 
the revealing partitions we can use detection operators 
A which are linear combinations of permutations. Then 
the detection probabilities tr \p\A\ and tr [poA] are inde- 
pendent of d, and if they are at all different, measuring A 
on all K copies distinguishes p\ and po with any desired 
degree of certainty. 

This shows that for getting good discrimination e 2 — > 1 
we do not really need orthogonal states. What counts is 
that po and pi are different along appropriate directions. 
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